Loyverse
BUSINESS · COMMERCE & FINANCE
Items, inventory, receipts, and customers across that merchant’s stores.
Connecting Loyverse in practice
Loyverse’s quota is 300 requests per 300 seconds per account, an average of one a second with no documented burst, and an OAuth access token lives only 43,200 seconds so a long-running agent refreshes twice a day. The simpler alternative carries a warning in Loyverse’s own words: "Be aware that personal access token gives unlimited access to the targeted account."
Scopes that draw scrutiny
RECEIPTS_WRITECreates receipts, so an agent holding it can write sales into the merchant’s books rather than just read them.INVENTORY_WRITEEdits inventory levels, which moves real stock figures the shop floor depends on.EMPLOYEES_READReads employee information — staff personal data, separate from the merchant record, and the one most likely to raise a question in review.POS_DEVICES_WRITEUpdates POS device information, so it reaches the till configuration and not only the data it produces.Personal access tokenThe non-OAuth route, taken from the back office. Loyverse documents it as unlimited access to the account, so it cannot express read-only.
Rate limits
- "The current limit is 300 requests per 300 sec per account", plus additional resource-based rate limits.
- Over the limit returns HTTP 429 with error 429 RATE_LIMITED.
- List endpoints: `limit` defaults to 50 and maxes at 250.
Worth knowing
- OAuth access tokens come back with expires_in 43200, so refresh handling is mandatory rather than an optimisation.
- Cursor pagination returns 400 INVALID_CURSOR on a stale or malformed cursor, so a resumed job cannot assume yesterday’s cursor still works.
- Scope names are uppercase and space-separated in the authorize URL (ITEMS_READ RECEIPTS_WRITE) but lowercase in the OpenID discovery document’s scopes_supported, so a copy-paste between the two produces an invalid request.
- The version is in the base URL (https://api.loyverse.com/v1.0) and the published reference is a single OpenAPI YAML rendered through Redoc, so the endpoint list is not crawlable without fetching the spec.
Checked against Loyverse API reference (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Loyverse behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.